Why survey tools for EU data sovereignty need a different build
For most EU organizations that must keep respondent data in the EU, the usual short answer is to self-host LimeSurvey or Formbricks on infrastructure you control inside the EU. That answer only holds if the build is designed around where data is stored, who can reach it and which services receive it. A survey tool is not a closed box: the server, the database, the backups, the support sessions and every integration can each create a transfer under the GDPR.
The transfer definition is wider than most survey buyers expect. The EDPB's Guidelines 05/2021 (version 2.0) state that remote access from a third country is a transfer even when the person only views data on a screen for support or administration, and that storing data in a cloud outside the EEA is also a transfer. A vendor engineer in another country who opens a support ticket, a backup replicated to a non-EEA region or a hosting provider with remote administration outside the EEA can therefore all bring Chapter V into play, and Article 44 applies to onward transfers too. Ask your hosting provider and every support path where access originates, and document it before go-live.
Three decisions determine whether the outcome holds: the edition, the hosting region and the integrations. LimeSurvey Cloud lists Germany and Finland as recommended EU regions, but a Cloud subscription still places the vendor in the processing chain, so you need its contract, sub-processor list and support access model in writing. Self-hosting moves that chain into your own environment, but the Formbricks Enterprise license is needed for SSO and access roles, and any webhook, Zapier, n8n or Slack connection that forwards responses to a non-EU service is a transfer in its own right. Confirm each edition feature, region and connector against the vendor's current documentation and your own data flow map before you commit.
Which transfer and data rules shape the survey build
This table maps each transfer and data rule to what it asks for in hosting, administrator access, vendor selection and exit planning. Read each row as a question to answer before choosing a hosting model, and use the last column to see where EU survey programs most often fail the check.
| Rule or source | What it means for the survey build | Evidence a data protection officer will expect |
|---|---|---|
| GDPR Article 44 and fines under Article 83(5)(c) | Every transfer of respondent data to a third country, including onward transfers, must meet Chapter V. Infringements of Articles 44 to 49 carry fines of up to EUR 20 million or 4% of worldwide annual turnover. | A transfer map listing every system that touches responses, with the location of each |
| EDPB Guidelines 05/2021 (version 2.0) | Remote access from a third country, even only viewing data on screen for support, and cloud storage outside the EEA both count as transfers. Hosting region and vendor support access must be planned together. | Hosting region confirmed in writing, and a list of who can open the admin console from outside the EEA |
| Schrems II (Case C-311/18) and Data Privacy Framework status | Privacy Shield was invalidated, while standard contractual clauses remained valid. The Data Privacy Framework adequacy decision covers only US organizations on its list, and its appeal (Case C-703/25 P) is pending, so do not rely on it as settled. | Current transfer impact assessment, and confirmation of any vendor's DPF listing and clauses |
| CLOUD Act, 18 U.S.C. 2713 | US providers must preserve or disclose data in their possession, custody or control wherever it is stored. Choosing a US-headquartered cloud edition or support provider can expose EU responses to that duty even when hosted in the EU. | Written confirmation of the provider's jurisdiction and its handling of foreign legal requests |
| GDPR Article 48 | A third-country court order to disclose personal data is enforceable in the EU only under an international agreement, such as a mutual legal assistance treaty. Build the vendor contract around this gap. | Contract clause requiring the vendor to challenge and notify before disclosure, where the law allows |
| Data Act Article 32 (Regulation (EU) 2023/2854) | Providers of data processing services must take measures against third-country governmental access to non-personal data held in the Union. Ask for these measures in the contract, not only in marketing material. | Vendor's written description of its Article 32 measures and where non-personal metadata is held |
| Data Act switching rights (Articles 25, 29 and 50) | Customers may switch to another provider or to on-premises infrastructure, with a maximum two-month notice period and a 30-day transition. Switching charges are banned from 12 January 2027. Exit planning should assume a move to self-hosting is possible. | Export test of responses and configuration, with a documented exit runbook |
How a survey response can leave the EU without anyone noticing
A survey response leaves the EU in more ways than the hosting location suggests. The transfer is often triggered by access, not storage: under the EDPB's Guidelines 05/2021 (version 2.0), remote access from a third country is a transfer even when the person only sees data on a screen for support or administration. So a survey platform hosted in Frankfurt can still transfer responses if a vendor's support engineer in another country opens a response table to debug a broken form. Ask every provider which roles can view respondent data, from which countries those roles work, and whether support sessions are logged and approved by your organization. Check whether the support process needs a written exception for data access, and record who approves it.
The second path is replication. A cloud region in the EEA does not settle where backups, logs, search indexes, error traces and disaster recovery copies are stored. Storage outside the EEA is also a transfer under the same guidelines, and the GDPR's Article 44 applies to onward transfers as well. The third path is the one most teams miss: webhooks and connectors. Formbricks supports webhooks and integrations with tools such as Slack, Notion, Zapier and n8n, and LimeSurvey plugins can export responses to external services. Each of these forwards respondent data to a destination you chose, often a US-hosted tool. Map every outbound connection in the survey stack, confirm the destination's region and transfer mechanism, and decide whether the flow is necessary at all.
Finally, an EU processor is not automatically outside the problem. The EDPB's Example 12 says that using an EU processor subject to third-country law with extraterritorial effect is not itself a transfer, but complying with a third-country authority request would be. The 18 U.S.C. 2713 provision of the CLOUD Act reaches providers' data regardless of location, so a vendor with US parent ownership needs an exposure assessment before you sign. Document that assessment as part of your transfer file, and keep it with your data protection impact assessment. Self-hosting on infrastructure you control removes most of these routes, but it does not remove the connectors, support access and backups you configure yourself.
Which self-hosted platform fits an EU-only respondent data model
An EU-only respondent data model depends on where the application runs, who operates it, and which features touch third-country services. The cards below compare the two self-hosted options and the two cloud editions, with the checks each one needs before respondent data goes live.
LimeSurvey Community Edition on your servers
LimeSurvey Community Edition is free to download and self-host under GPL v2.0 or later, with survey data stored on your own or your provider's server. Confirm the server location, the PHP version your build requires (PHP 8.1.29 or later with mbstring and PDO drivers), and a supported database such as PostgreSQL 14 or MariaDB 10.3.38 or later. Check that every plugin you enable keeps exports and logs inside the same environment. Ask your DPO to review the backup location, since backups are also a copy of respondent data.
LimeSurvey research features and exports
The Community Edition supports more than 30 question types and multilingual surveys in more than 80 languages, which covers most EU consultation and research designs. For analysis, the ExportR and ExportSTATAxml plugins move responses into R or Stata. Because these exports leave the survey server as files, set a retention rule for them and confirm that analysts work only on EU-hosted workstations. Test one full export before you commit to a design.
Formbricks Community Edition with Docker
The Formbricks core is licensed under AGPLv3 and can be self-hosted with Docker without a subscription. The Community Edition includes unlimited surveys, responses and users, full API access and webhooks, and a Helm chart for cluster hosting. It is limited to one workspace. Any private fork you run must be released under AGPLv3 unless an Enterprise license covers it, so have legal review your modification plan before you customize the code.
Formbricks Enterprise features for access control
Single sign-on through OIDC or SAML, teams and access roles, audit logs, and segments all sit behind the Enterprise license, and the enterprise code ships in the Docker images. Without that license, you have no SSO and no audit trail of who viewed respondent records, which many DPOs expect for access control. Ask the vendor to confirm in writing which features your license key unlocks, and budget for the license as a recurring cost.
LimeSurvey Cloud in a German or Finnish region
LimeSurvey Cloud offers hosting in Germany, Finland, the UK, the USA, Canada and Australia, and recommends Germany or Finland for EU customers. Choosing an EU region is not enough on its own. Confirm in writing the processing location of every component, the sub-processors, any remote support access from outside the EEA, and where backups are stored. If the subscription lapses, the account falls back to the Free package and keeps access to collected responses, so confirm where that data sits afterward.
Formbricks Cloud in Frankfurt
The Formbricks Hobby plan is hosted in Frankfurt, which makes it a candidate for EU-only testing or small surveys. Paid plans on Formbricks Cloud are priced per month, and the hosting region for those tiers should be confirmed separately rather than assumed from the Hobby plan. Ask for the sub-processor list, the location of error logs and webhook destinations, and whether support staff outside the EEA can access production data.
Choosing an EU hosting model for respondent data
You run LimeSurvey or Formbricks in your own EU data center or in an EU cloud account you control. The survey database, uploaded files and exports stay where you put them, and the transfer question narrows to who can administer the platform. LimeSurvey Community Edition is free to download and self-host, and Formbricks can be self-hosted with Docker without a subscription, so the software itself adds no vendor data flow.
- Database access: Your administrators, your managed database provider and any support engineer you grant access can read responses. Document each named role and remote session path.
- Backups: Snapshots and replicas often sit in a second region or a provider-managed store. Confirm that every copy is in the EU or EEA and that restores follow the same rules.
- Contract terms: Your hosting or colocation agreement and any managed services agreement should name the processing location, sub-processors and support access from outside the EEA.
- Region confirmations: Ask the provider in writing for the data center location, the location of backup and disaster recovery sites and any remote administration from third countries.
- Operations: You own patching, TLS, backups and access reviews, so these tasks belong in the data protection record.
Before go-live, ask your data protection officer to review the hosting map against the transfer analysis, and confirm that no vendor telemetry or update channel sends respondent data outside the EU.
Here the vendor operates the platform, and you choose an EU region when you create the account. LimeSurvey Cloud lists Germany and Finland among its hosting regions and recommends either for EU customers. Formbricks Cloud lists hosting in Frankfurt for its free tier. The data stays in the chosen region, but the vendor's staff, support tools and corporate group still form part of your processing chain.
- Database access: The vendor's operations and support staff can access production systems. Ask which roles exist, whether access is logged and whether access from outside the EEA happens.
- Backups: Ask where vendor backups and replicas are stored and whether they are held in the same region as the live database.
- Contract terms: Your data processing agreement should list the region, sub-processors, transfer safeguards for any non-EU support access and deletion timelines after cancellation.
- Region confirmations: Get written confirmation of the hosting region for your specific account, not only the marketing page, and confirm it again if you change plans.
- Subscription changes: LimeSurvey Cloud falls back to the Free package when a subscription expires and keeps access to collected responses, so plan for where data lives after expiry.
For each vendor, check whether the company's group structure or a non-EU parent could be subject to third-country access requests, and record that assessment before you sign.
In a hybrid model the survey runs inside the EU, but a SaaS tool receives respondent data after submission. Common examples are notification services, analytics dashboards, automation platforms and CRM connectors. Formbricks integrates with Slack, Notion, Zapier and n8n, and webhooks can push responses to any receiver. Once data leaves your EU platform for one of these tools, it is a separate transfer and needs its own analysis, even if the survey itself is fully hosted in the EU.
- Database access: The survey database may be EU-only, but the downstream vendor holds its own copy and its own staff access. Map each receiver separately.
- Backups: Downstream tools keep their own backups and logs, often outside the EU. Ask for their storage locations and retention settings.
- Contract terms: Each downstream vendor needs a data processing agreement and a documented transfer mechanism if data reaches a third country. Check whether the vendor's terms reserve the right to use payloads for product improvement.
- Region confirmations: Confirm the processing region of every receiver, including support tooling, error logging and email delivery services.
- Data minimization: Send only the fields the receiver needs. Remove free-text answers and identifiers from webhooks unless the purpose requires them.
The safest path is to route responses only through tools that have confirmed EU processing, or to deliver results to an EU-hosted instance of the downstream tool. Illustrative example: a team that sends NPS scores to a US-hosted dashboard should expect that flow to appear in its transfer register.
How an EU survey rollout moves from data mapping to go-live
The sequence turns a set of surveys and integrations into a documented EU hosting design, a tested data-flow register and a handover the data protection officer can review. Each phase produces a named record that the next phase depends on.
Map every survey, field and integration
Start by listing each survey, form, question type that collects personal data, and every tool that receives responses, including webhooks, Slack or Notion connections, Zapier or n8n flows, exports and analytics tags. For each flow, record the data categories, the purpose, the recipient and where the data is stored or accessed from. DeployOpen runs this with your data protection lead and the survey owners, and the output is a transfer map that marks each flow as staying in the EEA, leaving it, or needing a decision. The step is done when the data protection officer has reviewed the map and no flow is unassigned.
Decide hosting location and access model
Using the transfer map, decide where the platform runs and who can reach it from outside the EEA. Self-hosting inside your own cloud account or data center keeps storage under your control, while an EU region of a cloud edition moves storage to a provider's infrastructure, so the provider's own access arrangements need review. Under the EDPB guidance, remote access from a third country, even only displaying data for support, counts as a transfer, so support access paths are part of this decision. The output is a hosting decision record that names the region, the operator, the support access model and the reasons for each choice.
Select the platform and edition against identity and reporting needs
Choose between LimeSurvey and Formbricks, and between community and paid features, by testing the requirements that the hosting record exposed. Confirm whether you need OIDC or SAML single sign-on, team roles, audit logs, statistical export or contact segments, because some of these are paid features in the Formbricks Enterprise license and the choice affects the whole design. Check the current edition, supported database and runtime requirements, and license obligations against your internal policy. The output is a platform decision record listing the selected product, edition, and any feature gaps with the workaround or the decision to accept them.
Build and harden the environment
Install the platform in the approved environment, configure the database, storage, backups, encryption in transit and at rest, administrator accounts, and network restrictions, and wire the approved integrations only. Disable any integration that is not on the transfer map and pin the versions you tested. A hardening checklist is applied, and each setting is recorded in configuration as code so that the state can be reproduced. The output is a built environment with a configuration baseline that matches the hosting decision record.
Migrate existing responses under a documented route
If you already run surveys on another tool or have response data in a spreadsheet or older system, move that data through a route you can explain. Confirm which records are personal data, which can be exported anonymized, and how retention periods carry over. Verify record counts and field mappings after each load, and keep the source copy under the same controls until the destination is accepted. The output is a migration log with counts, mapping decisions and a signed-off list of sources to retire.
Verify data flows and access against the register
Test every flow on the transfer map against the live environment: submit a test response, confirm which systems receive it, check that webhook destinations match the register, confirm that administrator and support access is limited to the roles in the hosting record, and check that logs do not hold response content they should not hold. Record each test with its date, tester and result. The output is a tested data-flow register in which every flow has a passed or a failed result with an owner for each failure.
Hand over the records and the operating procedures
Give the data protection officer and the operations team the full evidence set: the transfer map, hosting decision record, platform decision record, configuration baseline, migration log and data-flow register, together with runbooks for access reviews, updates, backups and integration changes. Walk the owners through the procedures and agree who approves a new survey, a new integration or a new support access request. The step closes when the handover is accepted in writing under the agreed scope. Ask any partner which of these records they produce, who keeps them after go-live, and what support terms apply.
Documentation data protection officers expect for survey data
This table lists the evidence a DPO or supervisory authority typically asks for, which component produces each item, and where gaps tend to appear. Use it as a working checklist when preparing a transfer assessment for a LimeSurvey or Formbricks deployment. DeployOpen prepares this evidence from the configuration and operations work, but the controller remains responsible for assessments, and independent auditors or certification bodies issue any formal opinion.
| Evidence item | Produced by | What the DPO checks | Common gap |
|---|---|---|---|
| Record of processing activities | Controller, with input from the survey owner and DeployOpen | Purposes, categories of respondents, recipients, retention and transfers are all stated | Survey tool recorded as a generic service, with no hosting region or sub-processors named |
| Transfer map and third-country exposure assessment | Controller, using hosting and integration records | Every hosting location, remote access path and onward transfer is listed and assessed | Support or admin access from outside the EEA not counted as a transfer |
| Processor agreements and sub-processor list | Controller and the hosting or cloud provider | Written instructions, sub-processor notice and EU-based processing commitments are on file | Third-party integrations (email, webhooks, analytics) missing from the sub-processor list |
| Data flow diagram | DeployOpen, from the reference architecture | Respondent data path from browser to database, backups, exports and connected tools | Diagram stops at the application, leaving webhooks and exports out |
| Region and access configuration export | Platform admin, exported by DeployOpen during handover | Database, storage and backup regions; admin and API access paths; encryption settings | Cloud edition region chosen by default rather than confirmed in writing |
| Retention and deletion settings | Survey owner, configured on the platform | Documented retention per survey, deletion procedure and evidence that deletion ran | Responses kept indefinitely in backups or exports without a stated period |
| SSO and role configuration export | Identity team and DeployOpen | Who can view identified responses, who administers the platform and how access is removed | Shared admin accounts or Formbricks SSO features assumed without confirming the license tier |
| Backup location records | DeployOpen and the infrastructure team | Backup regions, encryption, retention, restore test records and access controls | Backup targets outside the EU, or replicas in another region, not recorded |
| Exit plan under Data Act switching rights | Controller with the platform vendor and DeployOpen | Export formats, migration steps and notice periods for moving data to another provider or on-premises | Export tested only on sample data, or the exit plan absent from the processor contract |
Questions EU teams ask before self-hosting a survey tool
Does self-hosting LimeSurvey or Formbricks remove all transfer risk?
No. Self-hosting removes the vendor-side exposure of storing respondent data on a third party's servers, but transfer risk can come back through other routes. Remote access from a third country, even only displaying data on a screen for support, counts as a transfer under EDPB Guidelines 05/2021. Email providers, analytics, SSO providers, webhooks to tools such as Slack, Zapier or n8n, and any hosting provider or support firm with access to your servers each need a transfer assessment. Map every data flow, then confirm where each processor stores and accesses data and under which contract terms.
What does a self-hosted survey deployment cost, and what drives it up?
The cost splits into one-time work and recurring work. One-time items include hosting setup, database and backup configuration, SSO integration, data migration, and documentation for your data protection officer. Recurring items include infrastructure, patching, backups, monitoring, and support. Software cost depends on the edition: LimeSurvey Community Edition is free to download and self-host, and Formbricks can be self-hosted with Docker without a subscription, though some Formbricks features require an Enterprise license. The main cost drivers are the number of integrations, whether SSO and audit logs are required, the number of environments, the level of documentation your DPO expects, and how many people must be trained. Ask any partner for a quote built from a written scope that lists each of these items separately.
Is the Formbricks Community Edition enough without SSO?
It depends on your access model. The self-hosted Community Edition includes unlimited surveys, responses and users, full API access, webhooks and a Helm chart, but it is limited to one workspace and does not include OIDC or SAML SSO, teams and access roles, audit logs or segments. If your policy requires centralized sign-in, role-based access or audit trails for who viewed respondent data, you will need the Enterprise license or another control layer. Confirm these requirements with your security team before choosing an edition, and check the current Formbricks license documentation, since feature boundaries can change.
What does the internal team need to run a self-hosted survey tool?
Your team needs skills in four areas: operating the application stack, securing the hosting environment, managing identity and access, and handling data protection processes. For LimeSurvey, that means PHP and a supported database such as MySQL 8.0, PostgreSQL 14 or MariaDB 10.3.38, with mbstring and PDO drivers. For Formbricks, it means Docker or Kubernetes operations and a database. Plan for someone to own patching, backups and restore tests, monitoring, and the response to security advisories. If the team lacks capacity in any area, an implementation partner can cover the setup and hand over runbooks, or take on ongoing support under a retainer. Name a single internal owner either way.
How long does a self-hosted survey deployment take?
Duration depends on scope rather than on the tool alone. The main drivers are the number of integrations, the amount of existing survey data to migrate, the identity setup, the hosting approval process inside your organization, and the documentation required for your DPO or works council. A deployment with a single survey use case and no custom integrations will take far less time than a multi-country deployment with SSO, migration and a formal transfer assessment. Ask a partner to break the timeline into phases with written acceptance points, and ask your internal approvers which reviews will set the critical path.
Is LimeSurvey Cloud's EU region enough for GDPR compliance?
A hosting region is one input, not the whole answer. LimeSurvey Cloud offers hosting in Germany, Finland, the UK, the USA, Canada and Australia, and the vendor recommends Germany or Finland for EU customers. Choosing an EU region keeps storage inside the EEA, but you still need to assess the vendor's corporate structure, its support access from outside the EU, its sub-processors, and whether any third-country authority could compel access under laws such as the US CLOUD Act. EDPB Recommendations 01/2020 explain how to assess those risks. Self-hosting gives you direct control over those questions, while cloud editions shift part of the assessment to the vendor.
What happens to survey data if a LimeSurvey Cloud subscription expires?
When a LimeSurvey Cloud subscription expires, the account falls back to the Free package and keeps access to collected responses, according to the vendor's pricing FAQ. This matters for retention planning because your data does not disappear at expiry, but the plan limits and feature set change. Confirm the export options, the retention period for the account after downgrade, and the deletion process you must follow when you close the account. Write these terms into your records of processing so the cloud option can be evaluated the same way as a self-hosted deployment.
What to ask an implementation partner before signing
Start with the map of where respondent data lives and who can touch it. Ask the partner to list every region, sub-processor and support location involved in the chosen deployment, including backups, email relays used for survey invitations and reminders, and any log shipping or monitoring service. For LimeSurvey Cloud, confirm which hosting region the account uses, since the vendor lists Germany, Finland, the UK, the USA, Canada and Australia as options and recommends Germany or Finland for EU customers. For a self-hosted build, ask who operates the servers and in which country the cloud account or data center sits. Each of these answers feeds the transfer map that your data protection officer will expect. Under EDPB Guidelines 05/2021, a remote view of data from a third country counts as a transfer, so ask the partner to state how support engineers reach the system, from where, and under which approval.
Ask how remote access is restricted in practice. A useful answer names the jump host or bastion, the EU-based staff allowed to log in, the session recording and approval steps, and the process for emergency access outside business hours. Ask how the partner produces the inputs for a data protection impact assessment: the data flow diagram, the list of integrations with their transfer status, the retention settings in use, and the description of each role that can export responses. On licensing, ask who holds the Enterprise License Key for Formbricks if SSO, audit logs or access roles are required, and whether the key is registered to your organization or to the partner. The key ships with the Docker images and the Enterprise license is separate from the AGPLv3 core, so the answer determines who can renew, transfer or revoke access.
Review each integration for transfers before go-live. Formbricks lists connections to Slack, Notion, Zapier and n8n, and any webhook or export plugin can send answers to a non-EU endpoint. Ask the partner to keep a register of every outbound connection, the data fields it carries and the destination country, and to flag any SaaS tool that receives identified responses. Finally, write the commercial terms so they match your sovereignty position. The fixed scope should list deliverables, the regions, the named sub-processors and the acceptance tests in writing. The exit clause should reflect the Data Act, which gives customers the right to switch providers or move to on-premises infrastructure, with a maximum two-month notice period, a 30-day transition and a ban on switching charges from 12 January 2027. Confirm with counsel how these terms apply to your contract, and ask for export formats and a documented data return procedure.
